First, the PreparedStatement
placeholders (those ?
things) are for column values only, not for table names, column names, SQL functions/clauses, etcetera. Better use String#format()
instead. Second, you should not quote the placeholders like '?'
, it would only malform the final query. The PreparedStatement
setters already do the quoting (and escaping) job for you.
Here’s the fixed SQL:
private static final String SQL = "select instance_id, %s from eam_measurement"
+ " where resource_id in (select RESOURCE_ID from eam_res_grp_res_map where"
+ " resource_group_id = ?) and DSN like ? order by 2");
Here is how to use it:
String sql = String.format(SQL, "SUBSTR(DSN,27,16)"); // This replaces the %s.
preparedStatement = connection.prepareStatement(sql);
preparedStatement.setInt(1, defaultWasGroup);
preparedStatement.setString(2, "%Module=jvmRuntimeModule:freeMemory%");
See also:
- Sun JDBC tutorial: Using Prepared Statements
- Format string syntax